Extracted

• • Target

    5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977.exe

  • Size

    125KB

  • MD5

    88eeeb298fabd21ef29c0b89d7aee4f9

  • SHA1

    6ceb6efa6b16293c8ab278d9f4276ad9af1ca653

  • SHA256

    5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977

  • SHA512

    0ac2637718ca22b7ee102360fd324761b24e13c991615f93c7f6f8ede72474a372f3f664fac5bd72d04d4977c388d401c3bcaf6d78e655e31eba2b6a4b4b1547

  • SSDEEP

    1536:A/w/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioZkcOqJ40eZgYAv:A0ZTkLfhjFSiO3o3kcqZZG

  Score

  10^/10

  blustealerstormkittycollectionstealer

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2